Summary
Microsoft UFO contains an OS command injection vulnerability in mobile MCP tools that pass authenticated, caller-controlled values into ADB shell command arguments without comprehensive validation. An attacker with a valid Mobile MCP API key and access to a reachable ADB-authorized Android device may execute additional commands with Android shell-user privileges.
Microsoft UFO contains an OS command injection vulnerability in mobile MCP tools that pass authenticated, caller-controlled values into ADB shell command arguments without comprehensive validation. An attacker with a valid Mobile MCP API key and access to a reachable ADB-authorized Android device may execute additional commands with Android shell-user privileges.
Affected context
The issue occurs in deployments using Microsoft UFO's mobile MCP HTTP server and its type_text or launch_app tools. Risk is present when an authenticated caller can supply package_name or text values, the service can reach an Android device authorized for ADB, and those values are passed into ADB command arguments that are later reparsed by the remote Android shell. Exploitation does not inherently provide host operating-system execution, Android root privileges, or access beyond the Android shell user.
The issue occurs in deployments using Microsoft UFO's mobile MCP HTTP server and its type_text or launch_app tools. Risk is present when an authenticated caller can supply package_name or text values, the service can reach an Android device authorized for ADB, and those values are passed into ADB command arguments that are later reparsed by the remote Android shell. Exploitation does not inherently provide host operating-system execution, Android root privileges, or access beyond the Android shell user.
Exploit preconditions
- Attack surface: Mobile MCP HTTP tool endpoints using ADB-backed operations - Required access: A valid Mobile MCP API key and permission to invoke the
affected tools
- Environment requirement: A reachable Android device authorized for ADB - Trigger point: Processing caller-controlled text or package-name values
during type_text or launch_app execution
- Why exploitation is possible: ADB arguments are joined into a remote
command string and reparsed by the Android shell, allowing shell syntax in
insufficiently validated values to alter command interpretation
- Attack surface: Mobile MCP HTTP tool endpoints using ADB-backed operations - Required access: A valid Mobile MCP API key and permission to invoke the
affected tools
- Environment requirement: A reachable Android device authorized for ADB - Trigger point: Processing caller-controlled text or package-name values
during type_text or launch_app execution
- Why exploitation is possible: ADB arguments are joined into a remote
command string and reparsed by the Android shell, allowing shell syntax in
insufficiently validated values to alter command interpretation
Why this happens
The underlying bug is an OS command injection condition caused by treating caller-controlled data as safe command arguments across a shell boundary. The ADB client constructs a remote command string from supplied arguments, after which the Android shell interprets the resulting string. Without comprehensive validation, strict argument handling, or a non-shell execution path, metacharacters can change the intended command structure. This maps primarily to CWE-78, Improper Neutralization of Special Elements used in an OS Command, and is also related to CWE-88, Improper Neutralization of Argument Delimiters in a Command.
The underlying bug is an OS command injection condition caused by treating caller-controlled data as safe command arguments across a shell boundary. The ADB client constructs a remote command string from supplied arguments, after which the Android shell interprets the resulting string. Without comprehensive validation, strict argument handling, or a non-shell execution path, metacharacters can change the intended command structure. This maps primarily to CWE-78, Improper Neutralization of Special Elements used in an OS Command, and is also related to CWE-88, Improper Neutralization of Argument Delimiters in a Command.
Potential impact
- An attacker may execute unintended commands on an authorized Android device.
- Device data or application state could be altered or accessed within the Android shell user's permissions.
- Automation workflows may be disrupted or manipulated.
- The device could be used to affect connected services or downstream systems reachable with its permissions.
- The vulnerability could support persistence or follow-on activity within the device's privilege boundary.
- An attacker may execute unintended commands on an authorized Android device.
- Device data or application state could be altered or accessed within the Android shell user's permissions.
- Automation workflows may be disrupted or manipulated.
- The device could be used to affect connected services or downstream systems reachable with its permissions.
- The vulnerability could support persistence or follow-on activity within the device's privilege boundary.
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from becoming shell syntax. Secure-by-default patterns include invoking ADB through structured argument APIs that do not construct a remote shell command, applying strict allowlists and type constraints to package names and text fields, and separating data transport from command construction. Input trust should be reduced by treating all API values as untrusted, validating them before any shell boundary, and rejecting unexpected characters or formats where the business function permits. Access to Mobile MCP endpoints and ADB authorization should be narrowly scoped, devices should run with the minimum practical privileges, and service accounts should not expose unnecessary device or network capabilities.
Mitigation generally focuses on preventing untrusted values from becoming shell syntax. Secure-by-default patterns include invoking ADB through structured argument APIs that do not construct a remote shell command, applying strict allowlists and type constraints to package names and text fields, and separating data transport from command construction. Input trust should be reduced by treating all API values as untrusted, validating them before any shell boundary, and rejecting unexpected characters or formats where the business function permits. Access to Mobile MCP endpoints and ADB authorization should be narrowly scoped, devices should run with the minimum practical privileges, and service accounts should not expose unnecessary device or network capabilities.
How teams detect issues like this
Detection can combine static analysis for subprocess, ADB, shell, and string concatenation patterns involving HTTP-controlled values with code review of every tool-to-device command path. Reviewers should look for arguments joined into command strings, shell invocation flags, missing allowlists, and validation performed only after command construction. Runtime monitoring can correlate MCP tool calls with unusual ADB command activity, unexpected device state changes, or shell processes launched by automation services. CI policy enforcement can require structured process APIs, taint-analysis findings to be resolved, and security tests covering metacharacter handling without relying on production devices.
Detection can combine static analysis for subprocess, ADB, shell, and string concatenation patterns involving HTTP-controlled values with code review of every tool-to-device command path. Reviewers should look for arguments joined into command strings, shell invocation flags, missing allowlists, and validation performed only after command construction. Runtime monitoring can correlate MCP tool calls with unusual ADB command activity, unexpected device state changes, or shell processes launched by automation services. CI policy enforcement can require structured process APIs, taint-analysis findings to be resolved, and security tests covering metacharacter handling without relying on production devices.
